All Apps and Add-ons

splunk dashboard static pass url to drilldown

Sukisen1981
Champion

I have a static url , I am using splunk 6.4.x
from a dashboard table i want to open this static url https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle...
There is a column named vuln which contains this url , all I want to do is to click this column value and open this url in a new window.
NOTE - in the same table i have other rows which should open a different static url

0 Karma

elliotproebstel
Champion

If you aren't keen on using JavaScript (or don't have access/permission to upload JS files), I can share a workaround I developed for one of my dashboards.

First - you say you want to link to that static URL when a user clicks in that column. I assume you mean that every URL in that column will take the same general format - not you want to link to that same CVE, regardless of which row the user clicks in that column. If that's correct, here's a walkthrough:

STEP ONE: Split the URL
Here's an example with some run-anywhere code, where I split the URL you provided and extract everything after https://www.cvedetails.com/ (based on my earlier assumption that all URLs in this column will take that format)

| makeresults 
| eval url="https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-19116/version_id-212954/Oracle-JDK-1.8.html" 
| stats count by url 
| rex field=url "^.*\/\/[^\/]+\/(?<link_value>.+)"

The rex command here creates a second field called link_value.

STEP TWO: Define the fields you want to display in the dashboard
Step one created the field link_value, but we don't want to display that value in the dashboard. Make a list of the other columns in your table and add a <fields> tag to your dashboard on the line following </search> in your dashboard. In my little sample code above, the table now contains three fields: url, count, and link_value. We want to display url and count only, so we'd add this:

<fields>url, count</fields>

STEP THREE: Add the drilldown code
Within the <table> section of your XML, add this drilldown code, which will reassemble the URL and set it as the drilldown destination when users click on any row in the column url:

<drilldown>
  <condition field="url">
    <link target="_blank">
      <![CDATA[https://www.cvedetails.com/$row.link_value|n$]]>
    </link>
  </condition>
</drilldown>
0 Karma

Sukisen1981
Champion

https://www.cvedetails.com/$row.link_value%7Cn$

Receive error - web page not found , above is the url you will be directed to on clicking the url

0 Karma

Sukisen1981
Champion

I do think it is a version problem, remember I was on splunk 6.4.x. However, I tried it on 7.x on my local and this code works -



<![CDATA[$click.value2|n$]]>


just passing click.value2$|n$ works on splunk 7.x , maybe it is an issue with splunk 6.4.x

0 Karma

mayurr98
Super Champion

hey
you can do this without javascript I have downloaded tutorialdata.zip from this link
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchTutorial/Systemrequirements#Download_th...
and uploaded the same to my local machine!
In that, you have field called referer which is actually URL.
So using that field I have done the same which is your requirement
here is my XML it is very simple

<dashboard>
  <label>Drilldown URL Field Value</label>
  <description>Configure drilldown to redirect users to the URL value of the referer field.</description>
  <row>
    <panel>
      <table>
        <search>
          <query>index=main | head 50 | stats count by referer</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="referer">
            <link target="_blank">$click.value2|n$</link>
          </condition></drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Just change <condition field="vuln"> and change query with <your_query>

let me know if this helps !

0 Karma

mayurr98
Super Champion

have you tried this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...